Lookout - Critical Audit and Policy Changes v2 | Microsoft Sentinel Analytic Rules

Back


Id	6b2d4e8a-5f7c-4b9e-8a1d-3c5e7a9b2f4d
Rulename	Lookout - Critical Audit and Policy Changes (v2)
Description	Monitors critical audit events and policy changes from Lookout Mobile Risk API v2. Detects unauthorized configuration changes, policy modifications, security setting adjustments, and administrative actions that could impact mobile security posture. Provides comprehensive audit trail for compliance and security governance.
Severity	Medium
Tactics	DefenseEvasion Persistence PrivilegeEscalation Impact
Techniques	T1629 T1626
Required data connectors	LookoutAPI
Kind	Scheduled
Query frequency	15m
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic%20Rules/LookoutAuditEventV2.yaml
Version	2.0.3
Arm template	6b2d4e8a-5f7c-4b9e-8a1d-3c5e7a9b2f4d.json

KQL

LookoutEvents
| where EventType == "AUDIT"
| where AuditType in ("POLICY_CHANGE", "SECURITY_SETTING_CHANGE", "USER_MANAGEMENT", "CONFIGURATION_CHANGE")
| extend 
    ChangeImpact = case(
        AuditType == "POLICY_CHANGE", "High",
        AuditType == "SECURITY_SETTING_CHANGE", "High",
        AuditType == "USER_MANAGEMENT", "Medium",
        AuditType == "CONFIGURATION_CHANGE", "Medium",
        "Low"
    ),
    RiskLevel = case(
        ActorType == "SYSTEM" and AuditType in ("POLICY_CHANGE", "SECURITY_SETTING_CHANGE"), "Automated Change",
        ActorType == "ADMIN_USER" and AuditType == "POLICY_CHANGE", "Administrative Change",
        ActorType == "USER" and AuditType in ("POLICY_CHANGE", "SECURITY_SETTING_CHANGE"), "Unauthorized Change",
        ActorType == "UNKNOWN", "Suspicious Change",
        "Standard Change"
    )
| extend SecurityImplications = case(
    AuditAttributeChanges has "threat_response_level" and AuditAttributeChanges has "LOW", "Threat Response Weakened",
    AuditAttributeChanges has "auto_quarantine_enabled" and AuditAttributeChanges has "false", "Auto-Quarantine Disabled",
    AuditAttributeChanges has "compliance_enforcement" and AuditAttributeChanges has "false", "Compliance Enforcement Disabled",
    AuditAttributeChanges has "device_wipe_enabled" and AuditAttributeChanges has "false", "Device Wipe Disabled",
    AuditAttributeChanges has "admin" or AuditAttributeChanges has "privilege", "Privilege Changes",
    "Configuration Update"
)
| extend ComplianceRisk = case(
    SecurityImplications in ("Threat Response Weakened", "Auto-Quarantine Disabled", "Compliance Enforcement Disabled"), "Critical",
    SecurityImplications == "Device Wipe Disabled", "High",
    SecurityImplications == "Privilege Changes", "High",
    RiskLevel == "Unauthorized Change", "High",
    RiskLevel == "Suspicious Change", "Medium",
    "Low"
)
| extend ChangeDetails = case(
    isnotempty(AuditAttributeChanges), strcat("Attribute changes: ", tostring(AuditAttributeChanges)),
    isnotempty(TargetGuid), strcat("Target: ", TargetType, " (", TargetGuid, ")"),
    "General audit event"
)
| project
    TimeGenerated,
    EventId,
    AuditType,
    ChangeImpact,
    RiskLevel,
    SecurityImplications,
    ComplianceRisk,
    ChangeDetails,
    AuditAttributeChanges,
    ActorType,
    ActorGuid,
    TargetType,
    TargetGuid,
    TargetEmailAddress,
    ChangeType,
    EnterpriseGuid

YAML

customDetails:
  ChangeType: ChangeType
  ChangeImpact: ChangeImpact
  RiskLevel: RiskLevel
  ComplianceRisk: ComplianceRisk
  TargetType: TargetType
  SecurityImpact: SecurityImplications
  AuditType: AuditType
  ActorType: ActorType
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: ActorGuid
    identifier: FullName
  - columnName: TargetEmailAddress
    identifier: Name
- entityType: Host
  fieldMappings:
  - columnName: TargetGuid
    identifier: HostName
tactics:
- DefenseEvasion
- Persistence
- PrivilegeEscalation
- Impact
status: Available
queryPeriod: 1h
queryFrequency: 15m
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    groupByAlertDetails:
    - AuditType
    - ActorGuid
    matchingMethod: Selected
    reopenClosedIncident: false
    groupByCustomDetails:
    - SecurityImpact
    - ComplianceRisk
    - ActorType
    lookbackDuration: P1D
    groupByEntities:
    - Account
requiredDataConnectors:
- connectorId: LookoutAPI
  dataTypes:
  - LookoutEvents
severity: Medium
relevantTechniques:
- T1629
- T1626
name: Lookout - Critical Audit and Policy Changes (v2)
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic%20Rules/LookoutAuditEventV2.yaml
eventGroupingSettings:
  aggregationKind: AlertPerResult
description: |
  'Monitors critical audit events and policy changes from Lookout Mobile Risk API v2. Detects unauthorized configuration changes, policy modifications, security setting adjustments, and administrative actions that could impact mobile security posture. Provides comprehensive audit trail for compliance and security governance.'
triggerOperator: gt
alertDetailsOverride:
  alertTacticsColumnName: SecurityImplications
  alertSeverityColumnName: ComplianceRisk
  alertDescriptionFormat: '{{AuditType}} by {{ActorType}} with {{ComplianceRisk}} risk'
  alertDisplayNameFormat: 'Critical Audit Event: {{SecurityImplications}} by {{ActorType}}'
id: 6b2d4e8a-5f7c-4b9e-8a1d-3c5e7a9b2f4d
version: 2.0.3
triggerThreshold: 0
suppressionDuration: PT30M
suppressionEnabled: false
query: |
  LookoutEvents
  | where EventType == "AUDIT"
  | where AuditType in ("POLICY_CHANGE", "SECURITY_SETTING_CHANGE", "USER_MANAGEMENT", "CONFIGURATION_CHANGE")
  | extend 
      ChangeImpact = case(
          AuditType == "POLICY_CHANGE", "High",
          AuditType == "SECURITY_SETTING_CHANGE", "High",
          AuditType == "USER_MANAGEMENT", "Medium",
          AuditType == "CONFIGURATION_CHANGE", "Medium",
          "Low"
      ),
      RiskLevel = case(
          ActorType == "SYSTEM" and AuditType in ("POLICY_CHANGE", "SECURITY_SETTING_CHANGE"), "Automated Change",
          ActorType == "ADMIN_USER" and AuditType == "POLICY_CHANGE", "Administrative Change",
          ActorType == "USER" and AuditType in ("POLICY_CHANGE", "SECURITY_SETTING_CHANGE"), "Unauthorized Change",
          ActorType == "UNKNOWN", "Suspicious Change",
          "Standard Change"
      )
  | extend SecurityImplications = case(
      AuditAttributeChanges has "threat_response_level" and AuditAttributeChanges has "LOW", "Threat Response Weakened",
      AuditAttributeChanges has "auto_quarantine_enabled" and AuditAttributeChanges has "false", "Auto-Quarantine Disabled",
      AuditAttributeChanges has "compliance_enforcement" and AuditAttributeChanges has "false", "Compliance Enforcement Disabled",
      AuditAttributeChanges has "device_wipe_enabled" and AuditAttributeChanges has "false", "Device Wipe Disabled",
      AuditAttributeChanges has "admin" or AuditAttributeChanges has "privilege", "Privilege Changes",
      "Configuration Update"
  )
  | extend ComplianceRisk = case(
      SecurityImplications in ("Threat Response Weakened", "Auto-Quarantine Disabled", "Compliance Enforcement Disabled"), "Critical",
      SecurityImplications == "Device Wipe Disabled", "High",
      SecurityImplications == "Privilege Changes", "High",
      RiskLevel == "Unauthorized Change", "High",
      RiskLevel == "Suspicious Change", "Medium",
      "Low"
  )
  | extend ChangeDetails = case(
      isnotempty(AuditAttributeChanges), strcat("Attribute changes: ", tostring(AuditAttributeChanges)),
      isnotempty(TargetGuid), strcat("Target: ", TargetType, " (", TargetGuid, ")"),
      "General audit event"
  )
  | project
      TimeGenerated,
      EventId,
      AuditType,
      ChangeImpact,
      RiskLevel,
      SecurityImplications,
      ComplianceRisk,
      ChangeDetails,
      AuditAttributeChanges,
      ActorType,
      ActorGuid,
      TargetType,
      TargetGuid,
      TargetEmailAddress,
      ChangeType,
      EnterpriseGuid

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/6b2d4e8a-5f7c-4b9e-8a1d-3c5e7a9b2f4d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/6b2d4e8a-5f7c-4b9e-8a1d-3c5e7a9b2f4d')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{AuditType}} by {{ActorType}} with {{ComplianceRisk}} risk",
          "alertDisplayNameFormat": "Critical Audit Event: {{SecurityImplications}} by {{ActorType}}",
          "alertSeverityColumnName": "ComplianceRisk",
          "alertTacticsColumnName": "SecurityImplications"
        },
        "alertRuleTemplateName": "6b2d4e8a-5f7c-4b9e-8a1d-3c5e7a9b2f4d",
        "customDetails": {
          "ActorType": "ActorType",
          "AuditType": "AuditType",
          "ChangeImpact": "ChangeImpact",
          "ChangeType": "ChangeType",
          "ComplianceRisk": "ComplianceRisk",
          "RiskLevel": "RiskLevel",
          "SecurityImpact": "SecurityImplications",
          "TargetType": "TargetType"
        },
        "description": "'Monitors critical audit events and policy changes from Lookout Mobile Risk API v2. Detects unauthorized configuration changes, policy modifications, security setting adjustments, and administrative actions that could impact mobile security posture. Provides comprehensive audit trail for compliance and security governance.'\n",
        "displayName": "Lookout - Critical Audit and Policy Changes (v2)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ActorGuid",
                "identifier": "FullName"
              },
              {
                "columnName": "TargetEmailAddress",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "TargetGuid",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [
              "AuditType",
              "ActorGuid"
            ],
            "groupByCustomDetails": [
              "SecurityImpact",
              "ComplianceRisk",
              "ActorType"
            ],
            "groupByEntities": [
              "Account"
            ],
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic%20Rules/LookoutAuditEventV2.yaml",
        "query": "LookoutEvents\n| where EventType == \"AUDIT\"\n| where AuditType in (\"POLICY_CHANGE\", \"SECURITY_SETTING_CHANGE\", \"USER_MANAGEMENT\", \"CONFIGURATION_CHANGE\")\n| extend \n    ChangeImpact = case(\n        AuditType == \"POLICY_CHANGE\", \"High\",\n        AuditType == \"SECURITY_SETTING_CHANGE\", \"High\",\n        AuditType == \"USER_MANAGEMENT\", \"Medium\",\n        AuditType == \"CONFIGURATION_CHANGE\", \"Medium\",\n        \"Low\"\n    ),\n    RiskLevel = case(\n        ActorType == \"SYSTEM\" and AuditType in (\"POLICY_CHANGE\", \"SECURITY_SETTING_CHANGE\"), \"Automated Change\",\n        ActorType == \"ADMIN_USER\" and AuditType == \"POLICY_CHANGE\", \"Administrative Change\",\n        ActorType == \"USER\" and AuditType in (\"POLICY_CHANGE\", \"SECURITY_SETTING_CHANGE\"), \"Unauthorized Change\",\n        ActorType == \"UNKNOWN\", \"Suspicious Change\",\n        \"Standard Change\"\n    )\n| extend SecurityImplications = case(\n    AuditAttributeChanges has \"threat_response_level\" and AuditAttributeChanges has \"LOW\", \"Threat Response Weakened\",\n    AuditAttributeChanges has \"auto_quarantine_enabled\" and AuditAttributeChanges has \"false\", \"Auto-Quarantine Disabled\",\n    AuditAttributeChanges has \"compliance_enforcement\" and AuditAttributeChanges has \"false\", \"Compliance Enforcement Disabled\",\n    AuditAttributeChanges has \"device_wipe_enabled\" and AuditAttributeChanges has \"false\", \"Device Wipe Disabled\",\n    AuditAttributeChanges has \"admin\" or AuditAttributeChanges has \"privilege\", \"Privilege Changes\",\n    \"Configuration Update\"\n)\n| extend ComplianceRisk = case(\n    SecurityImplications in (\"Threat Response Weakened\", \"Auto-Quarantine Disabled\", \"Compliance Enforcement Disabled\"), \"Critical\",\n    SecurityImplications == \"Device Wipe Disabled\", \"High\",\n    SecurityImplications == \"Privilege Changes\", \"High\",\n    RiskLevel == \"Unauthorized Change\", \"High\",\n    RiskLevel == \"Suspicious Change\", \"Medium\",\n    \"Low\"\n)\n| extend ChangeDetails = case(\n    isnotempty(AuditAttributeChanges), strcat(\"Attribute changes: \", tostring(AuditAttributeChanges)),\n    isnotempty(TargetGuid), strcat(\"Target: \", TargetType, \" (\", TargetGuid, \")\"),\n    \"General audit event\"\n)\n| project\n    TimeGenerated,\n    EventId,\n    AuditType,\n    ChangeImpact,\n    RiskLevel,\n    SecurityImplications,\n    ComplianceRisk,\n    ChangeDetails,\n    AuditAttributeChanges,\n    ActorType,\n    ActorGuid,\n    TargetType,\n    TargetGuid,\n    TargetEmailAddress,\n    ChangeType,\n    EnterpriseGuid\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT30M",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Impact",
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": null,
        "templateVersion": "2.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}